Which versions of HAX CMS are affected by CVE-2026-46394?

HAX CMS (haxtheweb/haxcms-php) versions prior to 26.0.0 contain an OS command injection vulnerability in Git backend operations exploitable by authenticated users, with no public exploit identified…. A patch is available.

How to fix or mitigate CVE-2026-46394?

Within 24 hours: Inventory all systems running HAX CMS < 26.0.0 and restrict authenticated access to trusted networks only. Within 7 days: Implement input validation and sanitization for all Git operations; deploy logging to detect suspicious command patterns. Within 30 days: Monitor vendor security advisories for patch release (expected version 26.0.0); develop and test upgrade procedures; if timeline is critical, evaluate migration to alternative CMS platforms.

HAX CMS CVE-2026-46394

Q: What is the CVSS score of CVE-2026-46394?

CVE-2026-46394 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-34885 HIGH

OS Command Injection (CWE-78)

2026-06-05 GitHub_M

PHP RCE Command Injection

7.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 05, 2026 - 20:02 EUVD

Analysis Generated

Jun 05, 2026 - 19:27 vuln.today

CVSS changed

Jun 05, 2026 - 19:22 NVD

7.7 (HIGH)

DescriptionGitHub Advisory

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an OS command injection vulnerability exists in the Git.php library of the HAXcms PHP backend. The application constructs shell command strings using unsanitized input and executes them via proc_open(). An attacker who can control parameters passed into Git operations can execute arbitrary OS commands with the privileges of the web server. Out of 17 functions that invoke shell commands only 1 function (commit()) correctly uses escapeshellarg(). When combined with another vulnerability that allows configuration manipulation, this issue can lead to full remote code execution and complete system compromise. Version 26.0.0 patches the issue.

AnalysisAI

OS command injection in HAX CMS (haxtheweb/haxcms-php) prior to version 26.0.0 allows authenticated remote attackers to execute arbitrary commands as the web server user via Git operations in the PHP backend. The Git.php library passes unsanitized input into proc_open() across 16 of 17 shell-invoking functions, with only commit() correctly using escapeshellarg(). No public exploit identified at time of analysis, though the vendor advisory describes a clear chain to full RCE when combined with configuration manipulation.

Technical ContextAI

HAX CMS is a microsite/HAX-the-Web content management platform with both PHP and Node.js backends; this issue affects the PHP backend specifically (CPE cpe:2.3:a:haxtheweb:haxcms-php). The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The Git.php wrapper concatenates user-controlled parameters (branch names, paths, remotes, commit metadata) directly into shell command strings and dispatches them through proc_open(), bypassing PHP's escapeshellarg()/escapeshellcmd() safeguards. Because Git operations accept many fields that flow from HTTP request parameters into the wrapper, a single missed escape in any of the 16 vulnerable functions provides a direct shell metacharacter injection sink.

RemediationAI

Vendor-released patch: upgrade to HAX CMS 26.0.0 or later, which adds proper input sanitization to the Git.php wrapper per advisory GHSA-6jf3-9fgh-cmfr (https://github.com/haxtheweb/issues/security/advisories/GHSA-6jf3-9fgh-cmfr). If immediate upgrade is not possible, restrict network access to authenticated users only and place the application behind a reverse proxy that blocks Git-related API endpoints (trade-off: breaks any legitimate site-publishing or version-control workflows that depend on those routes). As an additional compensating control, run the PHP-FPM/web server process under a dedicated low-privilege account with no shell, no write access outside the HAX content tree, and no outbound network egress, to limit blast radius if exploitation occurs; this may break Git push/pull to remote origins. Audit account provisioning to minimize the number of users holding the low-privilege role required for Git operations until the patch is applied.